Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Mon, 6 Jul 2020 14:40:13 -0700
From:   Kees Cook <keescook@chromium.org>
To:     Will Deacon <will@kernel.org>
Cc:     Keno Fischer <keno@juliacomputing.com>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Oleg Nesterov <oleg@redhat.com>,
        Andy Lutomirski <luto@amacapital.net>,
        Will Drewry <wad@chromium.org>
Subject: Re: ptrace: seccomp: Return value when the call was already invalid
Message-ID: <202007061439.8BF61308@keescook>
References: <CABV8kRxA9mXPZwtYrjbAfOfFewhABHddipccgk-LQJO+ZYu4Xg@mail.gmail.com>
 <20200703083914.GA18516@willie-the-truck>
 <202007030815.744AAB35D@keescook>
 <20200703154426.GA19406@willie-the-truck>
 <202007030851.D11F1EFA@keescook>
 <20200704123355.GA21185@willie-the-truck>
 <202007042132.DAFA2C2@keescook>
 <20200706081550.GA23032@willie-the-truck>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20200706081550.GA23032@willie-the-truck>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, Jul 06, 2020 at 09:15:51AM +0100, Will Deacon wrote:
> On Sat, Jul 04, 2020 at 09:56:50PM -0700, Kees Cook wrote:
> > different per-architecture expectations). If I read this thread
> > correctly, we need to test:
> > 
> > 	syscall(-1), direct,  returns ENOSYS
> > 	syscall(-10), direct, returns ENOSYS
> > 	syscall(-1), SECCOMP_RET_TRACE+PTRACE_CONT, returns ENOSYS
> > 	syscall(-10), SECCOMP_RET_TRACE+PTRACE_CONT, returns ENOSYS
> > 	syscall(-1), ptrace+PTRACE_SYSCALL, returns ENOSYS
> > 	syscall(-10), ptrace+PTRACE_SYSCALL, returns ENOSYS
> > 
> > do we need to double-check that registers before/after are otherwise
> > unchanged too? (I *think* just looking at syscall return should be
> > sufficient to catch the visible results.)
> 
> There's also the case where the tracer sets the system call to -1 to skip
> it.

Yes, though that's already part of the seccomp selftests. (Specifically
TRACE_syscall's syscall_faked.)

-- 
Kees Cook